THREATOPS

THREAT OPS › Threat News › [NVD] CVE-2026-47427 (HIGH 7.5) — GitHub MCP Server is GitHub's official MCP Server. Prior to 1.1.0, the CompletionsHandler function in pkg/github/server.go accesses params.Ref without first checking whether it is nil, so a completion/complete request with a missing or empty ref field triggers a nil pointer deref

[NVD] CVE-2026-47427 (HIGH 7.5) — GitHub MCP Server is GitHub's official MCP Server. Prior to 1.1.0, the CompletionsHandler function in pkg/github/server.go accesses params.Ref without first checking whether it is nil, so a completion/complete request with a missing or empty ref field triggers a nil pointer deref

mednvdPublished 2026-07-28

CVE-2026-47427 CVSS: 7.5 HIGH Published: 2026-07-28T16:18:14.853

GitHub MCP Server is GitHub's official MCP Server. Prior to 1.1.0, the CompletionsHandler function in pkg/github/server.go accesses params.Ref without first checking whether it is nil, so a completion/complete request with a missing or empty ref field triggers a nil pointer dereference and a Go runtime panic; because the crash occur

Indicators of compromise

CVE-2026-47427cve

Original source: https://nvd.nist.gov/vuln/detail/CVE-2026-47427